IoT 開發筆記 - 關於歐盟 無線電設備指令 (Radio Equipment Directive, RED) RED-DA 對於聯網設備的資安自我檢查辦法

這兩年英國、新加坡、歐盟都有滿多資安相關的議題，例如英國 Product Security and Telecommunications Infrastructure (PSTI) 產品安全和電信基礎設施法案在 2024.04 生效，現在則幫忙公司處理歐盟 2025年夏天要推進的無線設備指令—委託法案 (Radio Equipment Directive – Delegated Act, 簡稱 RED-DA )

已知的粗略資訊：

• 商品若有聯網功能，需要依照 RED-DA 的要求自我檢驗一番，才能把商品賣進歐盟國家
• 尚未有中央單位負責檢驗，各大品牌找一些值得信任檢驗單位，請他們檢驗商品出檢驗報告，未來商品進歐盟時，被要求提供報告時，可以拿出來用

因此，產品負責人或銷售業務，其實要做的是趕緊找一間信任的資安檢驗公司，提出商品檢驗的需求，價格通常也不便宜，最重要檢驗的時程也不短，通常簽約繳件後也要數個月才會產出報告的，而報告其實是會高度依賴商品的使用情境跟品牌/廠牌，基本上代工廠不能公版做完一份就沒事，是品牌商也得依序產報告（找同一間資安公司，應當有些優惠吧？可以讓資安公司省去摸索商品，且相似的商品可以讓驗證機制加速）

總之，就會進行一些聯網設備(IoT)的處理，通常，資安公司也高度依賴產品公司的 IT 部門或負責研發的開發者提供的資訊。

為了加速檢驗報告的產生，公司可以先自行體檢：

• 使用 OpenVAS Scanner 等類似工具對聯網設備進行弱點掃描
• 請開發者整理產品用到了相關 libraries ，透過 CVE 資料庫進行查詢，若發現有漏洞就評估該怎樣更新
• 若像 WIFI AP 提供 http://192.168.1.1 登入後台使用，那至少必須改提供 https://192.168.1.1 自簽憑證方案

由於檢驗報告項目眾多，單純先列一下可以自我檢驗的部分，其他的部分，還是交給資安業者，讓專業的來吧

筆記一下，怎樣用 OpenVAS 來掃設備，當然，這是個 Docker 當道的時代，直接跑 Docker 即可，收工（誤），實測在 macOS 15 和 Windows 11 都可以正常運作的：

C:\Users\User>docker run -p 8443:443 --name openvas mikesplain/openvas

Unable to find image 'mikesplain/openvas:latest' locally

latest: Pulling from mikesplain/openvas

34667c7e4631: Pull complete

d18d76a881a4: Pull complete

119c7358fbfc: Pull complete

2aaf13f3eff0: Pull complete

67b182362ac2: Pull complete

c878d3d5e895: Pull complete

ec12cc49fe18: Pull complete

c4c454aeebef: Pull complete

27d3410150b2: Pull complete

e08d578dc278: Pull complete

44951337cd32: Pull complete

8c7fe885e62a: Pull complete

a4f833680e45: Pull complete

Digest: sha256:23c8412b5f9f370ba71e5cd3db36e6f2e269666cd8a3e3e7872f20f8063b2752

Status: Downloaded newer image for mikesplain/openvas:latest

Testing redis status...

Redis not yet ready...

Redis ready.

Checking for empty volume

Restarting services

 * Restarting openvas-scanner openvassd

   ...done.

 * Restarting openvas-manager openvasmd

   ...done.

 * Restarting openvas-gsa gsad

   ...done.

Reloading NVTs

Rebuilding NVT cache... done.

Checking setup

openvas-check-setup 2.3.3

  Test completeness and readiness of OpenVAS-9

  Please report us any non-detected problems and

  help us to improve this check routine:

  http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss

  Send us the log-file (/tmp/openvas-check-setup.log) to help analyze the problem.

  Use the parameter --server to skip checks for client tools

  like GSD and OpenVAS-CLI.

Step 1: Checking OpenVAS Scanner ...

        OK: OpenVAS Scanner is present in version 5.1.3.

        OK: OpenVAS Scanner CA Certificate is present as .

...

接著就在本機開啟 https://localhost:8443/ 來運作：

添加一則 task (左上角的紫色 icon ) -> 指定設備的 IP -> 右下角有 Actions 記得按下 Play icon 

運行好一陣子後，就會看到一些報告了，像是幫你檢驗 Web server 的版本是否有漏洞、網頁上是否有需要更新的 js libraries，例如：

至於嵌入式系統內部的自我檢查，其實可以善用美國國家單位提供的服務： nvd.nist.gov/vuln/search

在那邊去輸入資訊查詢，像是 curl 啊，等等

當然，這邊純人工檢查極累 Orz 所以，也有 API 服務可以申請，就能夠批次詢問了，細節請參考：

nvd.nist.gov/developers/vulnerabilities

最後，把玩一下小工具：pypi.org/project/cve-vulnerability-scanner/

% NVD_API_KEY='XXXX-XXXX-XXXX-XXXX' cve-vulnerability-scanner -p zlib -v 1.2.13 -o /tmp/output.md ; cat /tmp/output.md 

Scanning zlib version 1.2.13

Loading cached data for zlib

Scan complete. Report generated in /tmp/output.md

# Security Vulnerability Report

Generated on: 2024-11-09 08:53:47

## zlib 1.2.13

### CVE-2023-45853

Severity: CRITICAL

CVSS Score: 9.8

Version Range: * to 1.3

Published: 2023-10-14T02:15:09.323

Last Modified: 2024-08-01T13:44:58.990

Description: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

### CVE-2023-48106

Severity: HIGH

CVSS Score: 8.8

Version Range: * to *

Published: 2023-11-22T18:15:09.630

Last Modified: 2023-12-02T00:27:03.327

Description: Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_resolve function in the mz_os.c file.

### CVE-2023-48107

Severity: HIGH

CVSS Score: 8.8

Version Range: * to *

Published: 2023-11-22T23:15:10.663

Last Modified: 2023-12-27T04:15:07.277

Description: Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_has_slash function in the mz_os.c file.

### CVE-2023-6992

Severity: MEDIUM

CVSS Score: 5.5

Version Range: * to 2023-11-16

Published: 2024-01-04T12:15:23.690

Last Modified: 2024-01-10T01:14:35.027

Description: Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow.

A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software.

Patches: The issue has been patched in commit  8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

### CVE-2003-0107

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2003-03-07T05:00:00.000

Last Modified: 2022-06-22T16:40:46.327

Description: Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denial of service or possibly execute arbitrary code.

### CVE-2004-0797

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2004-10-20T04:00:00.000

Last Modified: 2022-06-22T16:40:46.360

Description: The error handling in the (1) inflate and (2) inflateBack functions in ZLib compression library 1.2.x allows local users to cause a denial of service (application crash).

### CVE-2005-2096

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2005-07-06T04:00:00.000

Last Modified: 2022-06-22T16:40:46.413

Description: zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.

### CVE-2005-1849

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2005-07-26T04:00:00.000

Last Modified: 2022-06-22T16:40:46.380

Description: inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an invalid file that causes a large dynamic tree to be produced.

### CVE-2009-1391

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to 2.015

Published: 2009-06-16T23:30:00.203

Last Modified: 2018-10-03T22:00:28.997

Description: Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.

### CVE-2009-1391

Severity: UNKNOWN

CVSS Score: 0.0

Version Range: * to *

Published: 2009-06-16T23:30:00.203

Last Modified: 2018-10-03T22:00:28.997

Description: Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.

這工具純把玩，困難之處就是做 version 和 library name 比對，這工具純示意，仍有非常大進步的空間，甚至該把這空間交給專業的資安公司就好，畢竟這是個分工的時代，且需要大量的人力檢視 Orz

Javascript 開發筆記 - 盡可能使用 npm 指令處理套件安全更新，此例升級 electron 和 electron-builder

之前寫的練習擺在 github 一直收到套件安全的升級通知信（這只是其中一條），以前在處理這個時，都是人工改掉 package.json ，這次來用指令試試：

% git clone https://github.com/changyy/node-electron-based

% cd node-electron-based

% source env_nvm.sh 

Now using node v16.20.2 (npm v8.19.4)

% npm install

npm WARN deprecated asar@3.2.0: Please use @electron/asar moving forward.  There is no API change, just a package name change

npm WARN deprecated electron-osx-sign@0.6.0: Please use @electron/osx-sign moving forward. Be aware the API is slightly different

added 557 packages, and audited 558 packages in 10s

69 packages are looking for funding

  run `npm fund` for details

11 vulnerabilities (4 moderate, 7 high)

To address issues that do not require attention, run:

  npm audit fix

To address all issues (including breaking changes), run:

  npm audit fix --force

Run `npm audit` for details.

接著就如上述所言，用 npm audit fix 查看一下：

% npm audit fix

up to date, audited 558 packages in 860ms

69 packages are looking for funding

  run `npm fund` for details

# npm audit report

electron  <=22.3.24

Severity: high

Depends on vulnerable versions of @electron/get

Electron vulnerable to out-of-package code execution when launched with arbitrary cwd - https://github.com/advisories/GHSA-7x97-j373-85x5

Electron context isolation bypass via nested unserializable return value - https://github.com/advisories/GHSA-p7v2-p9m8-qqg7

Electron affected by libvpx's heap buffer overflow in vp8 encoding - https://github.com/advisories/GHSA-qqvq-6xgj-jw8g

ASAR Integrity bypass via filetype confusion in electron - https://github.com/advisories/GHSA-7m48-wc93-9g85

fix available via `npm audit fix --force`

Will install electron@28.1.4, which is a breaking change

node_modules/electron

got  <11.8.5

Severity: moderate

Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97

fix available via `npm audit fix --force`

Will install electron@28.1.4, which is a breaking change

node_modules/got

  @electron/get  <=1.14.1

  Depends on vulnerable versions of got

  node_modules/@electron/get

minimatch  <3.0.5

Severity: high

minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3

fix available via `npm audit fix`

node_modules/dir-compare/node_modules/minimatch

  dir-compare  <=2.4.0

  Depends on vulnerable versions of minimatch

  node_modules/dir-compare

    @electron/universal  1.0.1 - 1.3.3

    Depends on vulnerable versions of dir-compare

    node_modules/@electron/universal

      app-builder-lib  22.10.4 - 24.0.0-alpha.13

      Depends on vulnerable versions of @electron/universal

      node_modules/app-builder-lib

        dmg-builder  22.10.4 - 24.0.0-alpha.13

        Depends on vulnerable versions of app-builder-lib

        node_modules/dmg-builder

          electron-builder  19.25.0 || 22.10.4 - 24.6.0

          Depends on vulnerable versions of app-builder-lib

          Depends on vulnerable versions of dmg-builder

          Depends on vulnerable versions of simple-update-notifier

          node_modules/electron-builder

semver  7.0.0 - 7.5.1

Severity: moderate

semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

fix available via `npm audit fix`

node_modules/simple-update-notifier/node_modules/semver

  simple-update-notifier  1.0.7 - 1.1.0

  Depends on vulnerable versions of semver

  node_modules/simple-update-notifier

11 vulnerabilities (4 moderate, 7 high)

To address issues that do not require attention, run:

  npm audit fix

To address all issues (including breaking changes), run:

  npm audit fix --force

使用 npm audit fix --force 處理：

% npm audit fix --force

npm WARN using --force Recommended protections disabled.

npm WARN audit Updating electron to 28.1.4, which is a SemVer major change.

added 10 packages, removed 13 packages, changed 15 packages, and audited 555 packages in 4s

76 packages are looking for funding

  run `npm fund` for details

# npm audit report

minimatch  <3.0.5

Severity: high

minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3

fix available via `npm audit fix`

node_modules/dir-compare/node_modules/minimatch

  dir-compare  <=2.4.0

  Depends on vulnerable versions of minimatch

  node_modules/dir-compare

    @electron/universal  1.0.1 - 1.3.3

    Depends on vulnerable versions of dir-compare

    node_modules/@electron/universal

      app-builder-lib  22.10.4 - 24.0.0-alpha.13

      Depends on vulnerable versions of @electron/universal

      node_modules/app-builder-lib

        dmg-builder  22.10.4 - 24.0.0-alpha.13

        Depends on vulnerable versions of app-builder-lib

        node_modules/dmg-builder

          electron-builder  19.25.0 || 22.10.4 - 24.6.0

          Depends on vulnerable versions of app-builder-lib

          Depends on vulnerable versions of dmg-builder

          Depends on vulnerable versions of simple-update-notifier

          node_modules/electron-builder

semver  7.0.0 - 7.5.1

Severity: moderate

semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

fix available via `npm audit fix`

node_modules/simple-update-notifier/node_modules/semver

  simple-update-notifier  1.0.7 - 1.1.0

  Depends on vulnerable versions of semver

  node_modules/simple-update-notifier

8 vulnerabilities (2 moderate, 6 high)

To address all issues, run:

  npm audit fix

% git diff

diff --git a/package.json b/package.json

index f470e2b..4b7ac3d 100644

--- a/package.json

+++ b/package.json

@@ -19,7 +19,7 @@

     "concurrently": "^7.4.0",

     "copy-webpack-plugin": "^11.0.0",

     "cross-env": "^7.0.3",

-    "electron": "^20.1.1",

+    "electron": "^28.1.4",

     "electron-builder": "^23.3.3",

     "webpack-cli": "^4.10.0",

     "webpack-dev-server": "^4.11.0"

這樣應當算有處理到一個項目的更新，最後再看看之前的 build code 是否正常

% npm install

% npm run build

> simple-electron-app@1.0.0 build

> webpack-cli && electron-builder -mwl

assets by path ../../ 2.47 KiB

  assets by path ../../renderer/*.js 958 bytes

    asset ../../renderer/mainRenederer.js 910 bytes [emitted] [from: src/renderer/mainRenederer.js] [copied] [minimized]

    asset ../../renderer/index.js 48 bytes [emitted] [from: src/renderer/index.js] [copied] [minimized]

  asset ../../main/index.js 1.26 KiB [emitted] [from: src/main/index.js] [copied] [minimized]

  asset ../../preload/mainRenderer.js 289 bytes [emitted] [from: src/preload/mainRenderer.js] [copied] [minimized]

asset index.html 495 bytes [emitted] [from: src/html/mainRenderer/index.html] [copied]

asset index.js 253 bytes [emitted] [minimized] (name: mainRendererHTML)

./src/html/mainRenderer/index.js 380 bytes [built] [code generated]

WARNING in configuration

The 'mode' option has not been set, webpack will fallback to 'production' for this value.

Set 'mode' option to 'development' or 'production' to enable defaults for each environment.

You can also set it to 'none' to disable any default behavior. Learn more: https://webpack.js.org/configuration/mode/

webpack 5.89.0 compiled with 1 warning in 146 ms

  • electron-builder  version=23.6.0 os=23.2.0

  • description is missed in the package.json  appPackageFile=/Volumes/Data/UserData/tmp/node-electron-based/package.json

  • writing effective config  file=dist/builder-effective-config.yaml

  • packaging       platform=darwin arch=arm64 electron=28.1.4 appOutDir=dist/mac-arm64

  • downloading     url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-darwin-arm64.zip size=95 MB parts=8

  • downloaded      url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-darwin-arm64.zip duration=36.971s

  • default Electron icon is used  reason=application icon is not set

  • skipped macOS application code signing  reason=cannot find valid "Developer ID Application" identity or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible, see https://electron.build/code-signing allIdentities=     0 identities found

                                                Valid identities only

     0 valid identities found

  • building        target=macOS zip arch=arm64 file=dist/simple-electron-app-1.0.0-arm64-mac.zip

  • building        target=DMG arch=arm64 file=dist/simple-electron-app-1.0.0-arm64.dmg

  • Detected arm64 process, HFS+ is unavailable. Creating dmg with APFS - supports Mac OSX 10.12+

  • packaging       platform=linux arch=x64 electron=28.1.4 appOutDir=dist/linux-unpacked

  • downloading     url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-linux-x64.zip size=102 MB parts=8

  • building block map  blockMapFile=dist/simple-electron-app-1.0.0-arm64.dmg.blockmap

  • building block map  blockMapFile=dist/simple-electron-app-1.0.0-arm64-mac.zip.blockmap

  • downloaded      url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-linux-x64.zip duration=30.749s

  • building        target=snap arch=x64 file=dist/simple-electron-app_1.0.0_amd64.snap

  • building        target=AppImage arch=x64 file=dist/simple-electron-app-1.0.0.AppImage

  • application Linux category is set to default "Utility"  reason=linux.category is not set and cannot map from macOS docs=https://www.electron.build/configuration/linux

  • default Electron icon is used  reason=application icon is not set

  • application Linux category is set to default "Utility"  reason=linux.category is not set and cannot map from macOS docs=https://www.electron.build/configuration/linux

  • packaging       platform=win32 arch=arm64 electron=28.1.4 appOutDir=dist/win-arm64-unpacked

  • downloading     url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-win32-arm64.zip size=108 MB parts=8

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/snap-template-4.0-2/snap-template-electron-4.0-2-amd64.tar.7z size=1.5 MB parts=1

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/appimage-12.0.1/appimage-12.0.1.7z size=1.6 MB parts=1

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/appimage-12.0.1/appimage-12.0.1.7z duration=5.225s

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/snap-template-4.0-2/snap-template-electron-4.0-2-amd64.tar.7z duration=5.425s

  • downloaded      url=https://github.com/electron/electron/releases/download/v28.1.4/electron-v28.1.4-win32-arm64.zip duration=42.26s

  • default Electron icon is used  reason=application icon is not set

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/winCodeSign-2.6.0/winCodeSign-2.6.0.7z size=5.6 MB parts=1

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/winCodeSign-2.6.0/winCodeSign-2.6.0.7z duration=4.001s

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/wine-4.0.1-mac/wine-4.0.1-mac.7z size=19 MB parts=3

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/wine-4.0.1-mac/wine-4.0.1-mac.7z duration=13.249s

  • building        target=nsis file=dist/simple-electron-app Setup 1.0.0.exe archs=arm64 oneClick=true perMachine=false

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/nsis-3.0.4.1/nsis-3.0.4.1.7z size=1.3 MB parts=1

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/nsis-3.0.4.1/nsis-3.0.4.1.7z duration=5.637s

  • downloading     url=https://github.com/electron-userland/electron-builder-binaries/releases/download/nsis-resources-3.4.1/nsis-resources-3.4.1.7z size=731 kB parts=1

  • downloaded      url=https://github.com/electron-userland/electron-builder-binaries/releases/download/nsis-resources-3.4.1/nsis-resources-3.4.1.7z duration=4.013s

  • building block map  blockMapFile=dist/simple-electron-app Setup 1.0.0.exe.blockmap

編譯正常，接下來再繼續處理 

% npm audit fix

up to date, audited 555 packages in 730ms

76 packages are looking for funding

  run `npm fund` for details

# npm audit report

minimatch  <3.0.5

Severity: high

minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3

fix available via `npm audit fix`

node_modules/dir-compare/node_modules/minimatch

  dir-compare  <=2.4.0

  Depends on vulnerable versions of minimatch

  node_modules/dir-compare

    @electron/universal  1.0.1 - 1.3.3

    Depends on vulnerable versions of dir-compare

    node_modules/@electron/universal

      app-builder-lib  22.10.4 - 24.0.0-alpha.13

      Depends on vulnerable versions of @electron/universal

      node_modules/app-builder-lib

        dmg-builder  22.10.4 - 24.0.0-alpha.13

        Depends on vulnerable versions of app-builder-lib

        node_modules/dmg-builder

          electron-builder  19.25.0 || 22.10.4 - 24.6.0

          Depends on vulnerable versions of app-builder-lib

          Depends on vulnerable versions of dmg-builder

          Depends on vulnerable versions of simple-update-notifier

          node_modules/electron-builder

semver  7.0.0 - 7.5.1

Severity: moderate

semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

fix available via `npm audit fix`

node_modules/simple-update-notifier/node_modules/semver

  simple-update-notifier  1.0.7 - 1.1.0

  Depends on vulnerable versions of semver

  node_modules/simple-update-notifier

8 vulnerabilities (2 moderate, 6 high)

To address all issues, run:

  npm audit fix

故事大概起源於 electron-builder ，只好先把他升級看看

% cat package.json | jq '.devDependencies["electron-builder"]'

"^23.3.3"

% npm update --dev electron-builder

% cat package.json | jq '.devDependencies["electron-builder"]'

"^23.3.3"

看來只好靠這招了：

% npm install electron-builder@latest --save-dev

% cat package.json | jq '.devDependencies["electron-builder"]'

"^24.9.1"

如此也確認都沒事了：

% npm audit

found 0 vulnerabilities

最終，其實也只是改 package.json 兩行 XD

% git diff package.json 

diff --git a/package.json b/package.json

index f470e2b..4c830f1 100644

--- a/package.json

+++ b/package.json

@@ -19,8 +19,8 @@

     "concurrently": "^7.4.0",

     "copy-webpack-plugin": "^11.0.0",

     "cross-env": "^7.0.3",

-    "electron": "^20.1.1",

-    "electron-builder": "^23.3.3",

+    "electron": "^28.1.4",

+    "electron-builder": "^24.9.1",

     "webpack-cli": "^4.10.0",

     "webpack-dev-server": "^4.11.0"

   }